CVE-2026-49865 kimai CVE debrief

Who should care

Defenders responsible for Kimai servers, especially those with publicly accessible invoice PDF preview or generation features, should assess exposure and potential impact. IT teams managing internal services and networks should verify reachability from Kimai servers and evaluate potential security risks.

Why it matters

CVE-2026-49865 is a server-side request forgery vulnerability in Kimai that allows attackers to issue outbound requests to internal targets during PDF rendering. Defenders should prioritize verifying exposure, assessing internal service reachability, and updating to version 2.58.0 or later.

• Server-side request forgery allows for internal network probing
• Server-side reachability checks can be performed by attackers
• Potential follow-on exploitation depends on deployment environment and accessible internal services
• Verification of Kimai server exposure and internal service reachability is necessary

Technical summary

The vulnerability exists in the invoice PDF preview and generation workflow of Kimai versions prior to 2.58.0. An attacker can control Markdown content that is later rendered into an invoice PDF, allowing the server-side PDF renderer to fetch remote image URLs embedded in Markdown image syntax. This enables the application server to issue outbound requests to attacker-controlled or internal targets during PDF rendering.

Defensive priority

Defenders should prioritize verifying exposure of Kimai servers, especially those with publicly accessible invoice PDF preview or generation features. Verify if internal services are reachable from the Kimai server and assess the potential impact of server-side request forgery.

Recommended defensive actions

• Verify Kimai server exposure and accessibility of invoice PDF preview or generation features
• Assess internal service reachability from Kimai servers
• Update to version 2.58.0 or later
• Monitor for suspicious outbound requests from Kimai servers
• Perform vulnerability scanning to identify potentially affected systems
• Review network logs for signs of exploitation attempts
• Implement additional security controls to limit the impact of a potential breach

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in Kimai versions prior to 2.58.0. The vulnerability allows server-side request forgery through Markdown image syntax in invoice PDFs. However, the scope of affected deployments and the extent of potential exploitation remain unknown. Defenders should verify exposure of Kimai servers, especially those with publicly accessible invoice PDF preview or generation features, assess internal service reachability, and update to version 2.58.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.